EUVD-2026-30103
GHSA-q845-rv2h-x553
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber
Primary rating from Vendor (palo_alto) · only source for this CVE.
CVSS VectorVendor: palo_alto
Lifecycle Timeline
5DescriptionCVE.org
A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript payload using the web interface.
This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).
Cloud NGFW and Prisma® Access are not impacted by this vulnerability.
AnalysisAI
Stored cross-site scripting in Palo Alto Networks PAN-OS® web interface allows a malicious authenticated administrator to inject persistent JavaScript payloads that execute in the browsers of other users who view the affected pages. Affected deployments include PA-Series and VM-Series firewalls and Panorama (virtual and M-Series) running PAN-OS 10.2.x, 11.1.x, 11.2.x, and 12.1.x branches. No active exploitation is confirmed - EPSS stands at 0.04% (13th percentile), SSVC exploitation status is 'none', and no public exploit code has been identified at time of analysis. Vendor-released patches are available for all affected branches.
Technical ContextAI
This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation - 'Cross-site Scripting'), specifically the stored variant, meaning attacker-supplied JavaScript is persisted server-side and served to subsequent users who load the affected page. The affected surface is the PAN-OS web management interface, which administrators use to configure firewall policy, network settings, and device management. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P) confirms the attack originates over the network, requires no complex conditions, but demands high-privilege credentials and passive victim interaction. CPE data nominally includes cpe:2.3:a:palo_alto_networks:cloud_ngfw and cpe:2.3:a:palo_alto_networks:prisma_access, but the vendor description explicitly excludes both products from impact - this CPE inclusion appears to be a data entry artifact and should not be used as a basis for triaging those platforms.
RemediationAI
Upgrade to one of the following vendor-patched releases based on the currently running branch: PAN-OS 10.2.18-h6 or later, PAN-OS 11.1.15 or later, PAN-OS 11.2.12 or later, or PAN-OS 12.1.7 or later. Full guidance is available in the Palo Alto Networks security advisory at https://security.paloaltonetworks.com/CVE-2026-0256. If immediate patching is not feasible, restrict access to the PAN-OS web management interface to trusted administrative workstations only via management access policies and dedicated out-of-band management networks, reducing the pool of potential victim users who could trigger the stored payload. Note that restricting UI access does not prevent a malicious insider admin from storing a payload - it only limits the blast radius. Multi-admin environments with strict role-based access control should audit which accounts have web UI access and enforce the principle of least privilege across administrative tiers.
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access t
Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with Glob
GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted F
Remote code execution in Palo Alto Networks PAN-OS User-ID Authentication Portal (Captive Portal) allows unauthenticated
Buffer overflow in the management web interface in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x b
Authentication bypass in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS allows remote attackers to es
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
Palo Alto Networks PAN-OS management interface contains an authenticated file read vulnerability allowing reading of fil
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today